Define what validation is for

Syntax validation answers whether input fits the address forms your system supports. It does not prove that a mailbox exists, belongs to the person, accepts this message, or grants marketing permission. Write those as separate requirements before choosing a regular expression.

Use a maintained address parser from your platform or mail library. Email grammar includes quoted local parts and details that simplistic patterns reject, while permissive-looking patterns can accept control characters or ambiguous Unicode. Set practical input length and storage bounds, reject line breaks and header-injection characters, and handle one address—not a comma-separated header list—when the field represents one account.

Separate protocol support from product policy

An address with non-ASCII characters in the local part requires SMTPUTF8 support across relevant systems. An internationalized domain requires IDNA handling for DNS. If your sender, CRM, authentication provider, or downstream API cannot support that route, return an honest “internationalized addresses are not currently supported” result instead of “invalid email.”

Product policies such as “company addresses only” or “no plus tags” are not syntax rules. State the business reason, test false exclusions, and avoid rules based on folklore. Case handling is also nuanced: domain comparison is case-insensitive, but changing the local part can alter identity semantics. Preserve the submitted form and use an explicitly reviewed comparison strategy.

Build a labeled test corpus

Include:

  • ordinary ASCII addresses;
  • subdomains and plus-addressing;
  • quoted forms supported by your parser;
  • Unicode local/domain examples when SMTPUTF8 is supported;
  • missing domain/local part, whitespace, control characters, and header injection;
  • over-limit input and malformed IDNA.

Label expected parser result and product decision separately. Run the corpus whenever the library or normalization code changes.

Verify ownership when needed

For an account, send a single-use, time-limited confirmation link and require a CSRF-protected action. Use consistent responses where registration status could be enumerated, rate-limit requests, and avoid placing secrets in logs. A clicked link proves control at that time; it still does not grant consent for unrelated messages.

The implementation is ready when it accepts the address forms the complete system can process, rejects dangerous/malformed input, and explains unsupported forms without pretending syntax alone establishes mailbox quality.